Researcher’s Copilot worm hides in Word docs and spreads unseen for 144 days

Håkon Måløy didn’t just find a vulnerability. He built a self-spreading worm that turns Microsoft Copilot against its users, and Microsoft has known about it for 144 days without shipping a fix.

The attack is almost laughably simple. An attacker hides malicious instructions in a Word document using white text on a white background at a tiny font size. A human reader sees nothing. But Copilot, which strips out color and font-size formatting before processing text, reads every word and obediently executes the commands. When someone uses that poisoned document as a source in Copilot, the hidden prompt injection fires, and the malicious instructions get copied into the new file. That file is now a carrier. Use it as a template, and the infection propagates further.

The real-world attack chain writes itself. A compromised market analysis gets posted to the web. An analyst downloads it, uses Copilot to generate a financial report, and unwittingly bakes the hidden instructions into their output. That report gets shared with the CFO, whose Copilot-generated summary pulls from the infected file, spreading the payload deeper into the organization. Måløy is withholding the actual payload text, but the mechanism alone is enough to make security teams uncomfortable.

Microsoft confirmed the behavior on March 31. Two attempted fixes failed. After nearly five months of silence, Måløy went public. AI researcher Andreas Kirsch had recently joked that he wished someone would build exactly this kind of worm to convince skeptics that AI security risks aren’t theoretical. Wish granted. Prompt injection remains the ghost in every LLM-powered product, and Copilot’s document-processing pipeline just handed attackers an automated delivery system that requires no user to click a suspicious link or enable a macro. The document looks clean. Copilot does the rest.